ReadyNAS Duo v2 Windows 10 2019 Fall Update SEcurity and Shares

The Duo v1 was discontinued in 2011; the Duo v2 was discontinued in 2013.  Netgear ended firmware updates for both models in 2017 (similar to Microsoft ending support for Windows 7).  

Both models have much less memory than currently shipping ReadyNAS, and both have slow CPUs by modern standards.  Neither has hardware support for AES encryption and authentication, so performance with SMB 3 would be very slow (and likely isn't possible at all on the v1 - it's hardware design is very old).

Newer ReadyNAS (including the entry level RN212) support SMB 3.  They also get regular security updates (including hot fixes pushed by Netgear).

FWIW, SMB 3 isn't enough to protect you from ransomware.  Generally ransomware comes in through your PC, and it can spread to the NAS if the PC can access it.  SMB 3 helps in enterprise networks (because it can limit the spread of the ransomware if you have a lot of PCs).  But (IMO) it doesn't help much on home networks.

The best approaches are to use secure cloud backup (which generally does include some ransomware protection), or to have local backups of your data that can't be accessed by your PCs.  Running real-time malware protection on the PCs can also help - though new malware might still get through.

---

Woodfield wrote:

 

5. Worse perhaps, although you can see your shares in a browser, you will be warned that the certificate used by Netgear is unsafe. Carry on at your own risk. In other words, the firm cannot even be bothered to update its certificate, never mind deal with an appropriate software update - despite the warning from Micorosoft. 

You misunderstand certificates.  Netgear can't provide a CA certificate for your NAS - because that certificate declares that Netgear owns it and that it is under their administrative control. Which of course isn't the case.  Only you can get and install a CA certificate for your NAS.  The process isn't easy (and that doesn't have anything to do with Netgear).

What Netgear can do is generate a self-signed certificate.  That does allow the use of encrypted https, but it is vulnerable to man-in-the middle attacks (for instance, an evil server that intercepts transactions going to your bank website).  Generally that's not a real threat on a home network - but it is a big problem with internet-hosted servers (and that is why the browsers give you those warnings).

BTW, I do still have a Duo v1 (and an NV+ v1) in service.  Both are used as secondary backups for my primary NAS (an RN526).  SMB is disabled on them altogether, they back up selected shares on the main NAS using rsync.

---

Woodfield wrote:

1. With Windows 10 Fall update 2019 SMB 1.0 is automatically removed from your PC as unsafe. 

---

Afraid, you seem to be very new to Windows 10 and all it's development and enhancement over the year. This started to happen years ago already, not much change on the Win 10 Fall Update (which is still a work in progress and not released for production). FMI start your reading here: https://support.microsoft.com/en-us/help/4034314/smbv1-is-not-installed-by-default-in-windows

---

Woodfield wrote:

2. If you read the Microsoft thread about this, they have been warning for a long time that it is a security issue:  

---

Where was a lot written about a security vulnerabiity which affected both Windows and OS using SAMBA. In fact, the fixes were available in the field even before this made it to the public and a lot of copycats pushing started to make a lot of noise which appears to scare people until November 2019 (and it will continue much longer).  

---

Woodfield wrote:

3. Has Netgear done anything to either warn users or update its firmware? Absolutely not. You just find out that after the Windows Update Raidar no longer allows you to browse your drive through Windows File Explorer. Wonderful.

---

Netgear released a firmware update back in 2017 also for your NAS addressing the CVE-2017-7494 vulnerability.^which allowed to access and write to any shared folders even if the users wasn't authorized.

---

Woodfield wrote:

4. The fix is to go to Windows services, ignore the security warnings and enable SMB 1.0. So Netgear forces you to risk being the victim of ransomeware etc.  

---

The "big" vulnerability was fixed on both Windows and SAMBA source code - and deployed https://kb.netgear.com/000038792/RAIDiator-Version-4-1-16-Sparc Still, and shared folder legally accessible on a NAS, a Windows PC or Server, on a business class storage systems, ... can be encrypted by malware. Dropping SMB 1.0 does not change a s**t. 

---

Woodfield wrote:

5. Worse perhaps, although you can see your shares in a browser, you will be warned that the certificate used by Netgear is unsafe. Carry on at your own risk. In other words, the firm cannot even be bothered to update its certificate, never mind deal with an appropriate software update - despite the warning from Micorosoft.  

---

Well explained by StephenB above already.

---

Woodfield wrote:

6. It took me ages to find the above, albeit unsatisfactory, solution and that was only thanks to the pop ups from Microsoft guiding me to the problem. 

---

I won't talk of the fact that SMB1 isn’t modern or efficient - many features have made it to the higher protocol versions. Some would (massively) help on these underpowered NAS system like yours - however, it has never happened. Other features are simply out of scope, like protocol signing or encryption

Enabling the CIFS/SMB 1.0 feature can be done in a very easy way on the Windows 10 systems: Just add/enable the CIFS/SMB 1.0 Client feature.

There are many legit reasons why users can and must continue using the SMB 1.0 [Items 1..3 stolen from a Microsoft blog, and extended:

1. You’re still running XP or WS2003 under a custom support agreement.
2. You have old management software that demands admins browse via the so-called ‘network' aka 'network neighbourhood’ master browser list.
3. You run old multi-function printers with old firmware in order to “scan to share”.
4. You operate legacy storage systems, legacy NAS models, ... only supporting SMB 1.0/CIFS.